Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 21:56
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe
-
Size
445KB
-
MD5
395812837b0aa6cf4b6a8d3422722949
-
SHA1
65aeeed97bbd92e2895c7991244579b5f6a466a4
-
SHA256
798342d87cf72af042f7ba3d59d4c191e46cc7b11da7e618e595911d3b6a8f4b
-
SHA512
0abf895278479548229544f9d94336088cb8353f2185419de2161bae84700817e190317f2e3ce6ed64e00922b6eb7d4bd27c42c3dc8fa4425900ce88d5786215
-
SSDEEP
6144:ckfxJlwLX+7szkXV6ufajCf8t00wn90UkKMf2f2LNvNSrhSHGYdSwQiVn7BSE0zF:H0y0mp0t0rnhuvIrUmiv7BSEKw
Malware Config
Extracted
formbook
4.1
h0gd
hispansud.com
sanslisin156.com
izmediajo.com
fukugyo-kuchicomi.net
zjzmkj.net
powerupinnovations.com
unigradecuracao.net
inspirasimagz.com
isaacnqwilliams.store
john316graphics.net
wcparadise.net
trejoblanco.com
100x100cultura.com
beedivinehomedecor.com
polant.xyz
ascrete.com
www23855.com
emmagx.com
rekotalent.biz
fersamultiservicios.com
omaniaa.net
olusiune.xyz
shtycatur.store
private-cars.net
madduxworks.com
edhl-sa.net
vivendodesorteios.online
hec-outfits.com
onlinepoojabooking.com
sofievermeulen.com
recargas-online-virtual.online
all-wedding.com
perfectbikeshort.com
travimall.com
kxctut2.xyz
somaijobs.net
thecyber.academy
official-yukitakaoka.com
winkletest.com
anlegerschutz.review
812664.com
uniqe-base.com
roofingcompanywarren.com
thbzjs.com
tracktelevision.com
rckt-api.com
therealmccoypdfcoffee.com
dalehollowoutdoors.com
childcaregameplan.com
starbonus7.com
mturko.com
genelyn.net
swapit.press
bathroomremodelingtips.net
v60010.xyz
propertyprotect.net
dealipal.com
savefrsaom.net
sepela-food.com
thepetvetlife.com
el-balcon.com
frenda.online
sutefisufeles.xyz
trillumtrillum.com
x-surcinetenerife.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1456-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1456-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2112-21-0x00000000007D0000-0x00000000007FF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3352 set thread context of 1456 3352 JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe 98 PID 1456 set thread context of 3568 1456 MSBuild.exe 56 PID 2112 set thread context of 3568 2112 cmstp.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmstp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1456 MSBuild.exe 1456 MSBuild.exe 1456 MSBuild.exe 1456 MSBuild.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe 2112 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1456 MSBuild.exe 1456 MSBuild.exe 1456 MSBuild.exe 2112 cmstp.exe 2112 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1456 MSBuild.exe Token: SeDebugPrivilege 2112 cmstp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3352 wrote to memory of 1456 3352 JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe 98 PID 3352 wrote to memory of 1456 3352 JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe 98 PID 3352 wrote to memory of 1456 3352 JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe 98 PID 3352 wrote to memory of 1456 3352 JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe 98 PID 3352 wrote to memory of 1456 3352 JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe 98 PID 3352 wrote to memory of 1456 3352 JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe 98 PID 3568 wrote to memory of 2112 3568 Explorer.EXE 99 PID 3568 wrote to memory of 2112 3568 Explorer.EXE 99 PID 3568 wrote to memory of 2112 3568 Explorer.EXE 99 PID 2112 wrote to memory of 4544 2112 cmstp.exe 101 PID 2112 wrote to memory of 4544 2112 cmstp.exe 101 PID 2112 wrote to memory of 4544 2112 cmstp.exe 101
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_395812837b0aa6cf4b6a8d3422722949.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4544
-
-